[security] credential rotation checklist 2026-03

[github-actions]

Monthly Credential Rotation

Complete this checklist and close the issue when done.

Provider/API Keys

• Rotate OpenRouter API key
• Rotate Anthropic API key
• Rotate OpenAI API key
• Rotate Brave Search API key (if used)
• Rotate Google/MBTA/News API keys (if used)

Runtime/Auth

• Rotate WhatsApp linked session credentials if needed (planned maintenance window)
• Validate bot reconnection and message send/receive after rotation

GitHub / CI Secrets

• Update repository secrets used by CI/deploy
• Run npm run check after secret updates
• Verify Quality Gate passes on a test PR

Deployment/Cloud (AWS)

• Rotate/verify AWS credentials (prefer OIDC roles over long-lived keys)
• Validate health endpoint and logs after deployment restart

Notes

• Use bash scripts/rotate-gh-secrets.sh to push updated secrets from local env to GitHub Secrets.
• Never commit secrets to git-tracked files.